{"record":{"id":"2a59ff0b65c1ceb5","repo":"quarkusio/quarkus","slug":"spiffe-id-trust-domain-contains-invalid-character","errorCode":null,"errorMessage":"SPIFFE ID trust domain contains invalid character '' + c + '': ","messagePattern":"SPIFFE ID trust domain contains invalid character '' \\+ c \\+ '': ","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":113,"sourceCode":"        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }\n        if (uri.getFragment() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a fragment: \" + spiffeId);\n        }\n\n        String trustDomain = uri.getHost();\n        if (trustDomain == null || trustDomain.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-empty trust domain: \" + spiffeId);\n        }\n        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID trust domain exceeds maximum length of \"\n                    + MAX_TRUST_DOMAIN_LENGTH + \" bytes: \" + spiffeId);\n        }\n        for (int i = 0; i < trustDomain.length(); i++) {\n            char c = trustDomain.charAt(i);\n            if (!isValidTrustDomainChar(c)) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID trust domain contains invalid character '\" + c + \"': \" + spiffeId);\n            }\n        }\n\n        String path = uri.getPath();\n        if (path == null || path.isEmpty() || \"/\".equals(path)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-root path: \" + spiffeId);\n        }\n        if (path.endsWith(\"/\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID path must not have a trailing slash: \" + spiffeId);\n        }\n        String[] segments = path.split(\"/\", -1);\n        for (int i = 1; i < segments.length; i++) {\n            String segment = segments[i];\n            if (segment.isEmpty()) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID path must not contain empty segments: \" + spiffeId);\n            }","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L95-L131","documentation":"Per the SPIFFE spec, trust domains may only contain lowercase letters, digits, '.', '-' and '_'. SpiffeValidator.validateSpiffeId throws SpiffeConnectionException for any other character (uppercase letters, ':', spaces, etc.) in the trust domain.","triggerScenarios":"validateSpiffeId called with an ID whose host contains characters outside [a-z0-9._-], e.g. 'spiffe://Example.org/service' (uppercase) or a domain containing ':'.","commonSituations":"Uppercase hostnames copied from company intranet domains; trust domains containing spaces or trailing punctuation from config typos; using a full hostname:port as the domain.","solutions":["Lowercase the trust domain and strip characters outside [a-z0-9._-]","Use a registered SPIRE trust domain name exactly as configured in the server","Normalize the domain in config (trim whitespace, lowercase) before building IDs"],"exampleFix":"// before\nString spiffeId = \"spiffe://Example.Org/ns/default/sa/app\";\n// after\nString spiffeId = \"spiffe://example.org/ns/default/sa/app\";","handlingStrategy":"validation","validationCode":"static final Pattern TRUST_DOMAIN = Pattern.compile(\"^spiffe://[a-z0-9._-]+(/.*)?$\");\nstatic boolean trustDomainCharsetValid(String id) { return TRUST_DOMAIN.matcher(id).matches(); }","typeGuard":null,"tryCatchPattern":"try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { throw new IllegalArgumentException(\"Trust domain chars must be [a-z0-9._-]\", e); }","preventionTips":["Lowercase and trim trust domain values when loading config","Match the SPIRE server's registered trust domain exactly"],"tags":["spiffe","validation","trust-domain","character-set"],"backgroundTag":"spiffe-id-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}